memory forensics for virtualization environments